# Get authenticators

Retrieves all authenticators for a specific user. **Required permissions**: `organizations:read`, `orgs:read`, `users:read`, `apps:read`, `[appId]:read`, `authenticators:read`.

Endpoint: GET /v1/users/{userId}/authenticators
Security: ClientAccessToken

## Security:

  - `ClientAccessToken` (unknown)
    oauth2

## Path parameters:

  - `userId` (string, required)
    ID of the user

## Response 200:

  - `200` (unknown)
    User authenticators object

## Response 200 fields (application/json):

  - `result` (array, required)
    List of user authenticators

  - `result.id` (string, required)
    The ID of the authenticator, autogenerated upon registration

  - `result.type` (string, required)
    The type of the authenticator
    Enum: "totp", "email_magic_link", "email_otp", "sms_otp", "direct_otp", "webauthn", "password", "mobile_biometric", "pin_authenticator", "google", "facebook", "apple", "line", "saml", "oidc", "face"

  - `result.name` (string)
    The name of the authenticator

  - `result.status` (string, required)
    The status of the authenticator. An authenticator is `registered` if it hasn't yet been used to authenticate, and `active` if it's been used at least once. Admins can update the status to `deactivated` to manually block it (either temporarily or permanently) and an authenticator can become `locked` by the lockout rules defined in its settings.
    Enum: "Active", "Deactivated", "Registered", "Locked", "Deleted"

  - `result.user_id` (string)
    The ID of the user this authenticator is associated with

  - `result.status_changed_at` (string)
    The date the `status` field last changed, for example when an admin deactivated the authenticator or activated it again. Empty if the status has never changed or changed before this field was added. Updated only when the status change is saved. Status derived at read time, such as a disabled user or suspended device, does not update this field.

  - `result.registered_at` (string, required)
    The date the authenticator was registered. For social login methods, this corresponds to the date it was first used to authenticate. For email/SMS-based ones, it corresponds to the date the email/phone number was added to the user profile.

  - `result.last_successful_authentication` (string)
    Date this authenticator was last used to successfully authenticate.

  - `result.last_failed_authentication` (string)
    The last failed authentication date. For social login and email/SMS-based methods, this may corresponds to an authentications performed for another app in the tenant.

  - `result.last_accessed_app_id` (string)
    ID of the last application the authenticator was used to authenticate for

  - `result.app_id` (string)

  - `result.last_accessed_org_id` (string)
    ID of the last organization the authenticator was used to authenticate for

  - `result.lockout` (object)
    Lockout (applicable only when the authenticator’s status is locked)

  - `result.lockout.suspended_until` (string)
    Lockout remaining time

  - `result.lockout.suspended_at` (string)

  - `result.lockout.remaining_attempts` (number)
    Remaining attempts

  - `result.lockout.current_tier` (number)
    Tier number

  - `result.lockout.auto` (boolean)
    Whether the lockout was triggered automatically and suspension is still active

  - `result.registering_device` (object)
    The device that was used during registration, including device_id and timestamp.

  - `result.registering_device.device_id` (string, required)
    The device ID provided during registration.

  - `result.registering_device.timestamp` (string, required)
    The timestamp when the device was registered.

  - `result.last_used_devices` (array)
    The most recent devices used to authenticate with this authenticator (up to 5, newest first).

  - `result.last_used_devices.device_id` (string, required)
    The device identifier

  - `result.last_used_devices.device_ownership` (string, required)
    Device ownership relative to the authenticating user
    Enum: "user-owned", "non-user-owned"

  - `result.last_used_devices.timestamp` (string, required)
    Timestamp of the authentication event

  - `result.extra_data` (any)
    Additional data for the authenticator

  - `result.extra_data.email` (string, required)
    The email address

  - `result.extra_data.verified` (boolean, required)
    Indicates whether the email was verified

  - `result.extra_data.verified_at` (string)
    The date the email was verified. Absent until the email is verified.

  - `result.extra_data.app_id` (string)
    The app id

  - `result.extra_data.app_name` (string)
    The name of the app

  - `result.extra_data.phone_number` (string, required)
    The phone number

  - `result.extra_data.verified` (boolean, required)
    Indicates whether the phone number was verified

  - `result.extra_data.verified_at` (string)
    The date the phone number was verified. Absent until the phone number is verified.

  - `result.extra_data.email` (string)
    The email address of the user

  - `result.extra_data.phone_number` (string)
    The phone number of the user

  - `result.extra_data.username` (string)
    The username of the user

  - `result.extra_data.digits` (number, required)
    The number of digits in the token

  - `result.extra_data.period` (number, required)
    The period of time the token is valid for

  - `result.extra_data.algorithm` (string, required)
    The algorithm used to generate the token

  - `result.extra_data.issuer` (string, required)
    The issuer of the token

  - `result.extra_data.identifier` (string, required)
    The identifier of the user in the social network

  - `result.extra_data.updated_at` (string, required)
    The date the password was last updated

  - `result.extra_data.created_at` (string)
    The date the password was created

  - `result.extra_data.expired` (boolean, required)
    Whether the password is currently expired

  - `result.extra_data.temporary` (boolean, required)
    Whether the password is temporary and must be reset after first use

  - `result.extra_data.expires_in` (string)
    The date the password will be expired

  - `result.extra_data.credential_id` (string, required)
    WebAuthn credential ID (passkey ID)

  - `result.extra_data.rpId` (string, required)
    Relying Party ID

  - `result.extra_data.identifier` (string, required)
    The user identifier

  - `result.extra_data.devices` (array, required)
    List of devices

  - `result.extra_data.devices.os_type` (string, required)
    Device OS type

  - `result.extra_data.devices.os_version` (string, required)
    Device OS version

  - `result.extra_data.devices.browser` (string, required)
    Browser name

  - `result.extra_data.devices.user_agent` (string, required)
    User agent

  - `result.extra_data.devices.first_seen` (string, required)
    Date the credential was first used by this device, in ISO 8601

  - `result.extra_data.devices.last_seen` (string, required)
    Date the credential was last used by this device, in ISO 8601

  - `result.extra_data.aaguid_info` (object)
    The authenticator's AAGUID Information

  - `result.extra_data.aaguid_info.aaguid` (string)
    The authenticator AAGUID

  - `result.extra_data.aaguid_info.passkey_provider_name` (string)
    The authenticator name

  - `result.extra_data.aaguid_info.status` (string)
    The authenticator certificate status

  - `result.extra_data.public_key` (string, required)
    Public credential key for WebAuthn credentials

  - `result.extra_data.passkey_type` (string)
    Passkey type, synced across devices or bound to a single device
    Enum: "synced", "device_bound"

  - `result.extra_data.sync_status` (string)
    Backup state of the passkey. Only present for synced passkeys.
    Enum: "synced", "not_synced"

  - `result.extra_data.attestation_status` (string)
    Reflects certificate chain validation at registration and current FIDO MDS status verification
    Enum: "attested", "unattested"

  - `result.extra_data.algorithm` (string, required)
    The type of biometric

  - `result.extra_data.origin` (string, required)
    The origin of the biometric

  - `result.extra_data.displayName` (string, required)
    The display name of the biometric